External risk intelligence

PbootCMS Arbitrary Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-67960

PbootCMS is a web content management system. CMS platforms are typically deployed as public-facing web applications to serve content to the internet, making their controllers and web-accessible components commonly reachable by external users.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated code execution vulnerability has been identified in PbootCMS, a web content management system. This issue could potentially allow unauthorized individuals to run arbitrary code on affected systems. The main concern is confirming relevance and exposure due to the nature of Content Management Systems often being publicly accessible.

Attackers can run unauthorized code.
Consider this if PbootCMS is in use.
Confirm relevance and assess exposure impact.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable components of PbootCMS through the internet. By sending specially crafted requests, they could trigger the vulnerability in the MemberController.php, UserController.php, CommentController.php, ContentController.php, or helper.php files. Successful exploitation could lead to arbitrary code execution, allowing an attacker to take control of the affected system.

No authentication required.
Malicious requests to specific controllers.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in PbootCMS could allow an unauthenticated attacker to execute arbitrary code. This could occur when specific controller components are accessed, potentially leading to unauthorized system modifications or data compromise.

System code execution.
Via network access to controllers.
Unauthorized system modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in PbootCMS affects external-facing web applications, making it a priority for platform or infrastructure teams managing the CMS. The first step is to identify all instances of the affected technology, confirm their online exposure, and determine business criticality to prioritize remediation efforts.

Platform or infrastructure teams own resolution.
Verify online PbootCMS instances.
Plan vendor coordination for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PbootCMS?

PbootCMS is a web content management system designed to help users build and maintain websites. It functions as a platform that manages digital content and provides a framework for serving web pages to visitors. Because it is a CMS, it relies on various internal components, such as controllers, to process user requests and generate the dynamic content displayed on the site.

What does CWE-94 mean in the context of CVE-2026-67960?

CWE-94 refers to improper control of generation of code, often called code injection. In this vulnerability, it means the software does not sufficiently filter or validate inputs before processing them in its controllers. Because of this weakness, an attacker can supply malicious instructions that the server mistakenly executes as if they were legitimate commands, granting the attacker the ability to run arbitrary code on the underlying system.

How is this PbootCMS vulnerability triggered?

An attacker triggers this bug by sending a specially crafted network request directly to specific application files, including MemberController.php, UserController.php, CommentController.php, ContentController.php, or helper.php. The vulnerability requires no prior authentication, meaning an attacker does not need a user account to initiate the attack. Normal, non-malicious interaction with the website's standard features does not trigger this flaw.

Do I need to worry about this if my PbootCMS instance is internal?

According to the Halo Surface Signal, CMS platforms are typically deployed as public-facing web applications to serve content to the internet, which makes their controllers highly reachable by external users. While internal instances face a lower risk from the broader internet, any system that is network-accessible—even within a private corporate network—remains a potential target if an attacker gains entry to that network.

When should I take action for this vulnerability?

You should prioritize this immediately because the vulnerability allows for unauthenticated code execution. First, audit your environment to locate all running instances of PbootCMS. Once identified, evaluate which systems are reachable over the network and determine their importance to your business operations. This information will help your team plan the necessary updates or security measures provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.